--- title: Teleport 12 | daily.dev description: Teleport 12 ships with a preview of Device Trust, letting admins require access from authenticated, macOS Secure Enclave-verified devices tied into existing... canonical: https://daily.dev/posts/teleport-12-emgnfibky twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Teleport 12 | daily.dev og:description: Teleport 12 ships with a preview of Device Trust, letting admins require access from authenticated, macOS Secure Enclave-verified devices tied into existing... og:url: https://daily.dev/posts/teleport-12-emgnfibky og:image: https://api.daily.dev/og/posts/EmGNFIBKY.png og:image:alt: Teleport 12 og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Teleport 12 **[Teleport](https://daily.dev/sources/teleport)** · 6 min read · 0 upvotes · 0 comments ## Summary Teleport 12 ships with a preview of Device Trust, letting admins require access from authenticated, macOS Secure Enclave-verified devices tied into existing RBAC. It also previews passwordless certificate-based Windows access for local users without Active Directory, adds per-pod RBAC for Kubernetes, Azure and GCP CLI support via tsh commands, expanded database integrations for AWS and Azure, reworked Helm charts, dropped SHA1 workaround requirements for OpenSSH clients, signed/notarized macOS binaries, and a new tctl edit subcommand for editing resources directly. Breaking changes accompany the release and are detailed in the GitHub release notes. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What new features does Teleport 12 add for Kubernetes access control? Teleport 12 introduces per-pod RBAC for Kubernetes, extending role-based access beyond mapping Kubernetes users and groups to defining pod-level rules and permission restrictions. This integrates with existing Teleport RBAC features like role templating and just-in-time access requests, enabling fine-grained, pod-level access control at scale. It is available in both Teleport Community and Enterprise editions. _Teams tightening Kubernetes access control can track RBAC feature updates like this on daily.dev._ ### How does Teleport's Device Trust feature work in Teleport 12? Device Trust, previewed in Teleport 12, requires that access be performed from an authenticated and trusted device by leveraging the Secure Enclave on macOS to solve device challenges issued by the Teleport CA. It ties enrolled devices into existing Teleport RBAC so both user authorization and device trust are enforced. It is exclusive to macOS with a native client such as tsh or Teleport Connect, and only available in the Enterprise edition. _daily.dev helps engineers evaluating device-bound access controls stay current on releases like this._ ### Does Teleport 12 still require the PubAcceptedKeyTypes workaround for SHA1 in Server Access? No, Teleport 12 drops the need for the PubAcceptedKeyTypes workaround. New OpenSSH clients connecting to Teleport 12 clusters no longer require this workaround, which previously included the deprecated SHA1 algorithm, simplifying Server Access configuration for administrators upgrading to this version. _Ops teams planning an upgrade can follow breaking and deprecated behavior changes via daily.dev._ --- Tags: [#kubernetes](https://daily.dev/tags/kubernetes), [#authentication](https://daily.dev/tags/authentication) [View this post on daily.dev](https://daily.dev/posts/teleport-12-emgnfibky) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Teleport 12","url":"https://daily.dev/posts/teleport-12-emgnfibky","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/teleport-12-emgnfibky"},"datePublished":"2026-08-23T12:22:54.905Z","dateModified":"2026-08-23T12:49:03.063Z","description":"Teleport 12 ships with a preview of Device Trust, letting admins require access from authenticated, macOS Secure Enclave-verified devices tied into existing...","image":"https://media.daily.dev/image/upload/s--1KxV4ohY--/f_auto/v1722860400/public/Placeholder%2007","thumbnailUrl":"https://media.daily.dev/image/upload/s--1KxV4ohY--/f_auto/v1722860400/public/Placeholder%2007","isAccessibleForFree":true,"articleSection":"Teleport","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Teleport","logo":"https://media.daily.dev/image/upload/s--Dw-Bbw6O--/c_limit,w_256/f_auto,q_auto/v1787487494/logos/teleport?_a=BAMAMicg0","url":"https://daily.dev/sources/teleport"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/teleport-12-emgnfibky","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"kubernetes,authentication","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Teleport","item":"https://daily.dev/sources/teleport"},{"@type":"ListItem","position":3,"name":"Teleport 12"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/teleport-12-emgnfibky#faq","mainEntity":[{"@type":"Question","name":"What new features does Teleport 12 add for Kubernetes access control?","acceptedAnswer":{"@type":"Answer","text":"Teleport 12 introduces per-pod RBAC for Kubernetes, extending role-based access beyond mapping Kubernetes users and groups to defining pod-level rules and permission restrictions. This integrates with existing Teleport RBAC features like role templating and just-in-time access requests, enabling fine-grained, pod-level access control at scale. It is available in both Teleport Community and Enterprise editions. Teams tightening Kubernetes access control can track RBAC feature updates like this on daily.dev."}},{"@type":"Question","name":"How does Teleport's Device Trust feature work in Teleport 12?","acceptedAnswer":{"@type":"Answer","text":"Device Trust, previewed in Teleport 12, requires that access be performed from an authenticated and trusted device by leveraging the Secure Enclave on macOS to solve device challenges issued by the Teleport CA. It ties enrolled devices into existing Teleport RBAC so both user authorization and device trust are enforced. It is exclusive to macOS with a native client such as tsh or Teleport Connect, and only available in the Enterprise edition. daily.dev helps engineers evaluating device-bound access controls stay current on releases like this."}},{"@type":"Question","name":"Does Teleport 12 still require the PubAcceptedKeyTypes workaround for SHA1 in Server Access?","acceptedAnswer":{"@type":"Answer","text":"No, Teleport 12 drops the need for the PubAcceptedKeyTypes workaround. New OpenSSH clients connecting to Teleport 12 clusters no longer require this workaround, which previously included the deprecated SHA1 algorithm, simplifying Server Access configuration for administrators upgrading to this version. Ops teams planning an upgrade can follow breaking and deprecated behavior changes via daily.dev."}}]} ```